\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Cost Sensitive Machine Learning Approach for Intrusion Detection},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2014-01-15 (revised: 15 January 2014)}
\def\TheID{\makeatother }
\def\TheDate{2014-01-15}
\title{A Cost Sensitive Machine Learning Approach for Intrusion Detection}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Adamu  Teshome}

             \author[2]{Dr.Vuda Sreenivasa  Rao}

             \affil[1]{  Bahir Dar University}

\renewcommand\Authands{ and }

\date{\small \em Received: 11 December 2013 Accepted: 4 January 2014 Published: 15 January 2014}

\maketitle


\begin{abstract}
        


The problems with the current researches on intrusion detection using data mining approach are that they try to minimize the error rate (make the classification decision to minimize the probability of error) by totally ignoring the cost that could be incurred. However, for many problem domains, the requirement is not merely to predict the most probable class label, since different types of errors carry different costs. Instances of such problems include authentication, where the cost of allowing unauthorized access can be much greater than that of wrongly denying access to authorized individuals, and intrusion detection, where raising false alarms has a substantially lower cost than allowing an undetected intrusion. In such cases, it is preferable to make the classification decision that has minimum cost, rather than that with the lowest error rate.For this reason, we examine how cost-sensitive machine learning methods can be used in Intrusion Detection systems. The performance of the approach is evaluated under different experimental conditions and different models in comparison with the KDD Cup 99 winner resultsin terms of average misclassification cost, as well as detection accuracy and false positive ratesthough the winner used original KDD dataset whereas for this research NSL-KDD dataset which is new version of the original KDD cup data and it is better than the original dataset in that it has no redundant data is used. For comparison of results of CS-MC4, CS-CRT and KDD winner result, it was found that CS-MC4 is superior to CS-CRT in terms of accuracy, false positives rate and average misclassification costs. CS-CRT is superior to KDD winner result in accuracy and average misclassification costs but in false positives rate KDD winner result is better than both CS-MC4 and CS-CRT classifiers.

\end{abstract}


\keywords{intrusion detection, data mining, cost sens-itive learning.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
he field of intrusion detection has received increasing attention in recent years. One reason is the explosive growth of the Internet and the large number of networked systems that exist in all types of organizations. The increased number of networked machines has led to a rise in unauthorized activity, not only from external attackers but also from internal sources such as disgruntled employees and people abusing their privileges for personal gain \hyperref[b22]{[26]}.Since intrusions take advantage of vulnerabilities in computer systems or use socially engineered penetration techniques,intrusion detection (ID) is often used as another wall of protection. Intrusion detection includes identifying a set of malicious actions that compromise the integrity, confidentiality, and availability of information resources.\par
Enough data exists or could be collected to allow network administrators to detect any violations. Unfortunately, the data is so volumes, and the analysis process so time consuming that the administrators don't have the resources to go through it all and find the relevant knowledge, save for the most exceptional situations \hyperref[b26]{[30]}.Given the nature of this problem, the possible solution is data mining approach \hyperref[b2]{[3]}, \hyperref[b26]{[30]}.\par
Data mining approach for intrusion detection techniques generally fall into one of two categories; misuse detection and anomaly detection. In misuse detection, each instance in a data set is labeled as 'normal' or 'intrusion' and a learning algorithm is trained over the labeled data. These techniques are able to automatically retrain intrusion detection models on different input data that include new types of attacks, as long as they have been labeled appropriately. Unlike manual intrusion detection systems, models of misuse are created automatically, and can be more sophisticated and precise than manually created signatures. A key advantage of misuse detection techniques is their high degree of accuracy in detecting known attacks and their variations. Their obvious drawback is the inability to detect attacks whose instances have not yet been observed.\par
Anomaly detection, on the other hand, builds models of normal behavior, and automatically detects any deviation from it, flagging the latter as suspect. Anomaly detection techniques thus identify new types of intrusions as deviations from normal usage \hyperref[b4]{[5]}. While an extremely powerful and novel tool, a potential draw-back of these techniques is the rate of false alarms. This can happen primarily because previously unseen (yet legitimate) system behaviors may also be recognized as anomalies, and hence flagged as potential intrusions. Hybrid IDS combine bothmethods and it is better one  {\ref [22]}.\par
The problem with the current researches is that they try to minimize the error rate (make the classification decision to minimize the probability of error) by totally ignoring the cost that could be incurred. However, for many problem domains, the requirement is not merely to predict the most probable class label, since different types of errors carry different costs  {\ref [10]}.\par
For example of such problem in the case of computer network security include authentication, where the cost of allowing unauthorized access can be much greater than that of wrongly denying access to authorized individuals, and intrusion detection, where raising false alarms has a substantially lower cost than allowing an undetected intrusion. In such cases, it is preferable to make the classification decision that has minimum expected cost, rather than that with the lowest error probability \hyperref[b19]{[23]}.\par
Another very important case is, if class imbalanced datasets occurs but this happens in many real-world applications where the class distributions of data are highly imbalanced \hyperref[b19]{[23]}. Again, it is assumed that the minority or rare class is the positive class, and the majority class is the negative class. Often the minority class is very small, such as 1\% of the dataset. If most traditional (cost insensitive) classifiers are applied on the dataset, they will likely to predict everything as negative (the majority class) \hyperref[b29]{[33]}.\par
The intrusion data used for this research, KDD data set, which is publicly available and most widely used data set, has class distributions of training and test datasets with different distribution and each attack types has different costs. Statistically, the attacks of U2R and R2L are of the rarest, which makes them very hard to predict. On the other hand, they are the most dangerous types. Once an attacker gains the super user right or successfully remote login, disasters of the whole system are nothing but unavoidable \hyperref[b16]{[19]}.\par
Comparably, attacks of Probe are not that much dangerous. Although attacks of DOS (denial of service) are massive in the whole original dataset, they impose less danger. This is because the nature of denial of service attacks lies in that they are trying to initiate as many as possible connections to consume the network traffics and server CPU time \hyperref[b16]{[19]}.\par
Because of the above mentioned reasons cost sensitive learning which considers cost in decision making with acceptable accuracy is better solution for computer network intrusion detection. We used cost sensitive learning algorithms, cost sensitive classification tree CS-CRT and cost sensitive decision tree CS-MC4 algorithms. These algorithms use misclassification cost matrix to minimize the expected cost and for the detection of best prediction. Yet despite its importance, the topic is seldom addressed and researched. 
\section[{II. Intrusion Detection, Cost Sensitive}]{II. Intrusion Detection, Cost Sensitive}\par
Machine Learning and Performance Measure An intrusion detection system attempts to detect intrusions. In this paper, we focus on networkbased systems, i.e., network intrusion detection systems (NIDS) whose primary source of data is network traffic. In contrast, there is host intrusion detection systems (HIDS) which rely on information gathered on individual hosts. Hybrid systems are both network-based and host-based \hyperref[b4]{[5]},  {\ref [22]}. 
\section[{a) Classification of intrusion detection based on different detection method i. Misuse Detection}]{a) Classification of intrusion detection based on different detection method i. Misuse Detection}\par
It is also named signature-based detection, which can transform the information of attack symptom or policy disobeying into state transition-based signature or rule, and such information is stored in signature database. To judge whether or not it is attack, pretreated case data should be first compared with the signature of signature database, and those conforming to attack signature data can be judged as attack  {\ref [22]}. Its advantage is high detection rate and low false alarm rate for known attacks; however, its detection capacity is low for unknown detection methods, and attack database should be renewed on a regular basis.\par
ii. Anomaly Detection It may establish a profiles for normal behavior of users, which comes from statistics data of users in the former period; when detection is performed, the profiles is compared with actual users' data, if the offset is below threshold value, user's behavior can be considered normal, and it has no intention of attacks; if the offset is above threshold value, user's behavior can be considered abnormal  {\ref [22]}. Anomaly detection is based on an assumption that intruder's behavior is different from normal users' behavior. Detection rate of the method is high, and it is more likely to detect unknown attacks, but misjudgment (false positive) rate is also high.\par
iii. Hybrid It is also possible to include both normal and attack data in the model. Such systems are referred to be hybrid detectors. 1. Collector: Provides an interface for accessing data that is used by the detection process. For a NIDS, the primary kind of data collector is a network tap. A tap provides access to all raw network packets which cross a particular position of a network.  The cost model of IDS devises the total expected cost of the IDS. The cost model depends on the detection performance of the IDS. Misclassification costs false positive (FP, the cost of misclassifying a negative instance into positive) and false negative (FN, the cost of misclassifying a positive instance into negative), and the cost of correct classification is zero. They simply assign FP as the weight to each negative instance, and assign FN as the weight to each positive instance. That is, the weight ratio of a positive instance to a negative instance is proportional to FN/FP \hyperref[b8]{[9]}, \hyperref[b16]{[19]}.\par
The cost of misclassifying an instance of class i as class j is C(i, j ) and is assumed to be equal to 1 unless specified otherwise(i, i ) = 0 for all i . Any classification tree can have a total cost computed for its terminal node assignments by summing costs over all misclassifications. The issue in cost sensitive learning is to induce a tree that takes the costs into account during its growing and pruning phases \hyperref[b16]{[19]}. These misclassification cost values can be given by domain experts, or learned via other approaches. In cost sensitive learning, it is usually assume that such a cost matrix is given and known. For multiple classes, the cost matrix can be easily extended by adding more rows and more columns.\par
When optimizing sampling levels to improve overall cost, a logical evaluation criterion is the cost itself. Cost is calculated as follows by taking the assumption C (+|+) = C (-|-) =0.Cost = FN rate x C (-|+) + FP rate x C (+|-). Therefore, once classification occurs in the cross-validation phase, the wrapper or filter calculates the validation cost and uses this information to select optimal sampling levels. This approach is Actual negative Actual positive    
\section[{CM (I, J)*C (I, J)}]{CM (I, J)*C (I, J)}\par
Where CM corresponds to confusion matrix, C corresponds to the cost matrix, and N represents the number of patterns tested [10]. 
\section[{IV. Data Collection and Preparation}]{IV. Data Collection and Preparation}\par
NSL-KDD data set which is the new version of KDD Cup 99 dataset and the only publicly available \hyperref[b18]{[21]} and the widely used data set for intrusion detection have been used for the experimental purpose. The process of data cleaning and preparation is highly dependent on the specific machine learning algorithm and software chosen and algorithms used for the machine learning task. The researcher attempted to prepare the data according to the requirements of the Tanagra which is powerful, user friendly and freely available for noncommercial purpose machine learning software  {\ref [11]} and according to the requirements of CS-MC4 and CS-CRT algorithms by consulting different literatures. 
\section[{V. Training and Testing Models}]{V. Training and Testing Models}\par
The Intrusion detection models were developed using cost sensitive classification tree CS-CRT and cost sensitive decision tree CS-MC4 algorithms on full training NSL-KDD dataset using a powerful machine learning and data mining Tanagra tool and then Full testing dataset of NSL-KDD passed through the developed models to detect the intrusions and find the detection error rates, precision, false positives rate, average misclassification cost and accuracy of the detection models but for comparison of models we used mainly average misclassification cost, false positives rate and accuracy of detection. 
\section[{VI. Experimentation}]{VI. Experimentation}\par
We used data mining software tool known as Tanagra version 1.4.34 available freely at  {\ref [11]}. The software is a GUI based software and easy to use. Tanagra is capable of classifying large volumes of data within a second depending on the speed and specification of computer processor. All experiments were performed using an Intel Core 2 Duo Processor 2.16 GHz processor with 4 GB of RAM and implemented on a Vista Windows operating system.\par
We have used NSL-KDD intrusion dataset which is available at \hyperref[b18]{[21]} and it is a dataset suggested to solve some of the inherent problems of the original KDD Cup 99 dataset \hyperref[b10]{[13,}\hyperref[b17]{20]}. The NSL-KDD dataset has the following advantages over the original KDD Cup 99 dataset.   We have used the cost matrix defined for the KDD Cup 99 Dataset \hyperref[b8]{[9]} which is shown in Table  {\ref 4}.Category Normal Probe DOS U2R R2L Normal 0 1 2 2 2 Probe 1 0 2 2 2 DOS 2 1 0 2 2 U2R 3 2 2 0 2 R2L 4 2 2 2 0 
\section[{VII. Experimentation and Result}]{VII. Experimentation and Result}\par
The experimentations have two major parts; the first one is experimentation on CS-MC4 and CS-CRT using all the 41 attributes and the second is experimentation on CS-MC4 and CS-CRT using information gain (IG) feature (attribute) selection method. Comparative discussions of each approaches used with the KDD 99 winner results are given.\par
Table \hyperref[tab_3]{5} summarizes comparison results of detection accuracy (which refers to the proportion that a type of data is correctly classified) of normal and 4 different attacks (i.e. Probe, Dos, U2R, R2L) based on CS-MC4 and CS-CRT classifiers using 24, 30, 37, and all the attributes in comparison with KDD winner results.  It is evident from this Table that: 
\section[{Cscrt}]{Cscrt} 
\section[{Cs-mc4}]{Cs-mc4} 
\section[{Cscrt}]{Cscrt} 
\section[{Cs-mc4}]{Cs-mc4} 
\section[{Cscrt}]{Cscrt} 
\section[{Cs-mc4}]{Cs-mc4} 
\section[{Cscrt}]{Cscrt} 
\section[{Cs-mc4}]{Cs-mc4} 
\section[{Cscrt}]{Cscrt}\par
1. For Normal: CS-MC4 classifiers outperform their CS-CRT counterparts in all cases but when only 30 attributes are used, the difference between the accuracy of CS-MC4 and CS-CRT became minimal i.e. 0.36\%. For this type of class, in all the cases the accuracy of the KDD winner result is better than both CS-MC4 and CS-CRT classifiers.\par
2. For Probe attack: the accuracy of CS-MC4 is better than that of CS-CRT when only 24 attributes are used, but in other circumstances CS-CRT outperforms CS-MC4. For this type of attack, in all the cases the accuracy of both CS-MC4 and CS-CRT is better than the KDD winner result.\par
3. For Dos attack: CS-MC4 classifiers outperform their CS-CRT counterparts in all cases but when only 30 attributes are used, the difference between the accuracy of CS-MC4 and CS-CRT became minimal, i.e. 0.17\%. For this type of attack, in all the cases the accuracy of both CS-MC4 and CS-CRT is better than the KDD winner result. 4. For U2R attack: the accuracy of CS-MC4 classifiers is better than their CS-CRT counterparts in all cases.\par
For this type of attack, in all the cases the accuracy of both CS-MC4 and CS-CRT is better than the KDD winner result except when only 24 attributes are used for CS-CRT classifier. 5. For R2L attack: accuracy of CS-MC4 classifiers is better than their CS-CRT counterparts in all cases.\par
For this type of attack, in all the cases the accuracy of both CS-MC4 and CS-CRT are by far better than the KDD Cup 99 winner result.\par
In general, it is evident from the above table that in terms of accuracy, CS-MC4 outperformed the CS-CRT. As it can be seen from the result, the feature selection method used (i.e. information gain value) did not increase the accuracy of CS-MC4 classifier. Even though CS-MC4 classifier achieved the same result using all the attributes (41 attributes) and 37 attributes (at information gain value greater than 0), the reduction of the attributes from 41 to 37 could increase the speed of the classifier and reduce the space required. CS-CRT achieved a better result when only 30 attributes (information gain value greater than and equal to 0.011) are used relative to the other cases.\par
So, feature selection using information again value achieved better result for CS-CRT classifier from 41 attributes to 30 attributes but for CS-MC4 classifier from 41 attributes to 37 attributes. Results which are achieved in this work are compared with the results obtained by KDD winner results as shown in table 4. As it can be seen, the accuracy of KDD Winner is only better in normal, but it is far worse than CS-MC4 and CS-CRT in U2R and R2L attacks; this might be because of the data used for this research is NSL-KDD intrusion dataset (which is new version of the original KDD cup data and it is better than the original dataset in that it Table \hyperref[tab_5]{6} summarizes the efficiency of information gain value for feature selection and the performance comparison of CS-MC4, CS-CRT classifier and KDD winner result based on overall accuracy, false positives rate and average misclassification cost using 24, 30, 37 and all the attributes for 5 attack classes on NSL-KDD dataset. And in all the cases, the Average misclassification cost of both CS-MC4 and CS-CRT is better than the KDD winner result. 4. Attribute reduction using information again value achieved better result for CS-CRT classifier from 41 attributes to 30 attributes, from 94.2\% to 98.4\% accuracy, from 7.1\% to 1.7\% false positive rate, and average misclassification cost from 0.0895 to 0.0335; but for CS-MC4 classifier it only reduce the attribute from 41 attributes to 37 attributes. 
\section[{VIII. Conclusions}]{VIII. Conclusions}\par
This paper focuses on using cost sensitive learning techniques to existing data mining algorithms to deal with cost of different types of attacks in intrusion detection while at the same time reducing the false positives rate. The cost issue is widely ignored in the intrusion detection research. As a result, most of the research projects tried to minimize the false positives rate which may not reflect real-world scenario of dealing with ever increasing different types of attacks with different costs; and an important consideration is the fact that raising false alarms carries a significantly lower cost than not detecting attacks.\par
For comparison results of CS-MC4, CS-CRT and KDD 99 winner result, it was found that CS-MC4 is superior to CS-CRT in terms of accuracy, false positives rate and average misclassification costs. CS-CRT is superior to KDD winner result in accuracy and average misclassification costs but in false positives rate KDD winner result is better than both CS-MC4 and CS-CRT classifiers.\par
This paper proposed learning approach for network intrusion detection that performs feature selection method using information gain by selecting important subset of attributes. The performance of the proposed approach on the NSL-KDD intrusion detection dataset achieved a better accuracy from 94.2\% to 98.4\% for the CS-CRT classifier. It also reduced the false positives for the CS-CRT algorithm from 7.1\% to 1.7\%, and the average misclassification costs from 0.0895 to 0.0335; but for the CS-CM4 algorithm, it only reduced the attribute from 41 to 37 attributes.Even though feature selection method could not increase accuracy or reduce false positive rate and average misclassification cost for CS-MC4, it could increase the speed of the classifier and reduce the computation space required. The experimental results have manifested that feature (attribute) selection improves the performance of IDS. \begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Figure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-3.png}
\caption{\label{fig_1}2 .}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Figure 2 :}\end{figure}
     \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.7138121546961326\textwidth}P{0.1361878453038674\textwidth}}
\multicolumn{2}{l}{b) Performance Measures}\\
\multicolumn{2}{l}{detection rate, low false alarm rate and lower average}\\
\multicolumn{2}{l}{misclassification cost. The followings are commonly}\\
\multicolumn{2}{l}{used performance measures}\\
i.\tabcellsep Error Rate\\
\tabcellsep The error rate, which is only an estimate of the\\
\multicolumn{2}{l}{true error rate and is expressed to be a good estimate, if}\\
\multicolumn{2}{l}{the number of test data is large and representative of}\\
\multicolumn{2}{l}{the population and is defined as}\\
{}[68]:\tabcellsep \end{longtable} \par
  {\small\itshape [Note: Recall and Precision are two widely used metrics employed in applications where successful detection of one of the classes is considered more significant than detection of the other classes [].]} 
\caption{\label{tab_0}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.02900262467191601\textwidth}P{0.03569553805774278\textwidth}P{0.25098425196850394\textwidth}P{0.5343175853018373\textwidth}}
\tabcellsep \tabcellsep \multicolumn{2}{l}{4. The number of records in the training and testing}\\
\tabcellsep \tabcellsep \tabcellsep sets are reasonable, which makes it affordable to\\
\tabcellsep \tabcellsep \tabcellsep run the experiments on the complete set without the\\
\tabcellsep \tabcellsep \tabcellsep need to randomly select a small portion.\\
\tabcellsep \tabcellsep \multicolumn{2}{l}{5. Statistical observations, one of the most important}\\
\tabcellsep \tabcellsep \tabcellsep deficiencies in the KDD dataset is the huge number\\
\tabcellsep \tabcellsep \tabcellsep of redundant records, which causes the learning\\
\tabcellsep \tabcellsep \tabcellsep algorithms to be biased towards the frequent\\
\tabcellsep \tabcellsep \tabcellsep records and thus prevent them from learning\\
\tabcellsep \tabcellsep \tabcellsep unfrequent records which are usually more harmful\\
\tabcellsep \tabcellsep \tabcellsep to networks such as U2R and R2L attacks.\\
\tabcellsep \tabcellsep \tabcellsep Table2 and Table3 shows the statistics of the\\
\tabcellsep \tabcellsep \multicolumn{2}{l}{redundant records in the KDD Cup 99 training and}\\
\tabcellsep \tabcellsep \multicolumn{2}{l}{testing datasets.}\\
Original\tabcellsep Records\tabcellsep \multicolumn{2}{l}{Distinct Records Reduction Rate}\\
Attacks\tabcellsep 3,925,650\tabcellsep 262,178\tabcellsep 93.32\%\\
Normal\tabcellsep 972,781\tabcellsep 812,814\tabcellsep 16.44\%\\
Total\tabcellsep 4,898,431\tabcellsep 1,074,992\tabcellsep 78.05\%\end{longtable} \par
 
\caption{\label{tab_1}Table 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3} \par 
\begin{longtable}{P{0.1796747967479675\textwidth}P{0.3040650406504065\textwidth}P{0.12439024390243901\textwidth}P{0.24186991869918698\textwidth}}
Original\tabcellsep \multicolumn{2}{l}{Records Distinct Records}\tabcellsep Reduction Rate\\
Attacks\tabcellsep 250,436\tabcellsep 29,378\tabcellsep 88.26\%\\
Normal\tabcellsep 60,591\tabcellsep 47,911\tabcellsep 20.92\%\\
Total\tabcellsep 311,027\tabcellsep 77,289\tabcellsep 75.15\%\end{longtable} \par
 
\caption{\label{tab_2}Table 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{5} \par 
\begin{longtable}{P{0.3923076923076923\textwidth}P{0.09807692307692308\textwidth}P{0.09807692307692308\textwidth}P{0.16346153846153846\textwidth}P{0.09807692307692308\textwidth}}
Normal\tabcellsep DOS\tabcellsep R2L\tabcellsep Probe\tabcellsep U2R\\
Cs-\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
mc4\tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_3}Table 5 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{6} \par 
\begin{longtable}{P{0.6697566628041715\textwidth}P{0.021668597914252605\textwidth}P{0.04629200463499421\textwidth}P{0.01772885283893395\textwidth}P{0.06500579374275782\textwidth}P{0.02954808806488992\textwidth}}
\multicolumn{2}{l}{Overall accuracy (\%)}\tabcellsep \multicolumn{2}{l}{False positives rate (\%)}\tabcellsep \multicolumn{2}{l}{Average Misclassification Cost}\\
CS-MC4\tabcellsep CS-CRT\tabcellsep CS-MC4\tabcellsep CS-CRT\tabcellsep CS-MC4\tabcellsep CS-CRT\\
All attributes 98.9\tabcellsep 94.2\tabcellsep 1.3\tabcellsep 7.1\tabcellsep 0.0199\tabcellsep 0.0895\\
24 attributes 98.8\tabcellsep 94.1\tabcellsep 1.4\tabcellsep 6.4\tabcellsep 0.0232\tabcellsep 0.0982\\
30 attributes 98.8\tabcellsep 98.4\tabcellsep 1.4\tabcellsep 1.7\tabcellsep 0.0201\tabcellsep 0.0335\\
37 attributes 98.9\tabcellsep 94.1\tabcellsep 1.3\tabcellsep 7.2\tabcellsep 0.0199\tabcellsep 0.0887\\
KDD winner 92.7\tabcellsep \tabcellsep 0.55\tabcellsep \tabcellsep 0.2331\tabcellsep \\
It is evident from above table that:\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{1. Overall accuracy of CS-MC4 classifiers is better}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{than their CS-CRT counterparts in all cases. And in}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{all the cases, the overall accuracy of both CS-MC4}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{and CS-CRT is better than the KDD winner result.}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{2. False positives rate of CS-MC4 classifiers are better}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{than their CS-CRT counterparts in all cases. And in}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{all the cases, the false positive rate of the KDD}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{winner result is better than both CS-MC4 and CS-}\tabcellsep \tabcellsep \tabcellsep \\
CRT classifiers.\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{3. Average misclassification cost of CS-MC4 classifiers}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{is better than their CS-CRT counterparts in all cases.}\tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_5}Table 6 :}\end{figure}
 			\footnote{© 2014 Global Journals Inc. (US) A Cost Sensitive Machine Learning Approach for Intrusion Detection} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[Lee and Stolfo ()]{b16}\label{b16} 	 		‘A Framework for constructing features and models for intrusion detection systems’.  		 			W Lee 		,  		 			S J Stolfo 		.  	 	 		\textit{ACM TransInfSystSecurity}  		2000.  	 
\bibitem[Domingos ()]{b5}\label{b5} 	 		‘A general method for making classifiers cost-sensitive’.  		 			P Domingos 		,  		 			Metacost 		.  	 	 		\textit{Proceedings of the Fifth International Conference on Knowledge Discovery and Data Mining},  				 (the Fifth International Conference on Knowledge Discovery and Data Mining)  		1999. ACM Press. p. .  	 
\bibitem[Heberlein et al. (1991)]{b15}\label{b15} 	 		‘A Method To Detect Intrusive Activity in a Networked Environment’.  		 			L T Heberlein 		,  		 			K N Levitt 		,  		 			B Mukherjee 		.  	 	 		\textit{Proceedings of the 14th National Computer Security Conference},  				 (the 14th National Computer Security Conference)  		october 1991. p. .  	 
\bibitem[Wafa et al. (2009)]{b22}\label{b22} 	 		‘Adaptive Framework for Network Intrusion Detection by Using Genetic-Based Machine Learning Algorithm’.  		 			S Wafa 		,  		 			Reyadhsh Al-Sharafat 		,  		 			Naoum 		.  	 	 		\textit{IJCS-NS International Journal of Computer Science and Network Security}  		April 2009. 9  (4) .  	 
\bibitem[Denning ()]{b4}\label{b4} 	 		‘An Intrusion Detection Model’.  		 			D E Denning 		.  	 	 		\textit{IEEE Trans-actions on Software Engineering, SE}  		1987. 13 p. .  	 
\bibitem[Anderson (1980)]{b11}\label{b11} 	 		\textit{Computer Security Threat Monitoring and Surveillance},  		 			J P Anderson 		.  		April 1980. Fort Washington, Pennsylvania: Anderson Co.  	 	 (Technicalreport) 
\bibitem[Turney ()]{b28}\label{b28} 	 		‘Cost-Sensitive Classification: Empirical Evaluation of a Hybrid Genetic Decision Tree Induction Algorithm’.  		 			P D Turney 		.  	 	 		\textit{Journal of Artificial Intelligence Research}  		1995. 2 p. .  	 
\bibitem[Zadrozny and Langford]{b30}\label{b30} 	 		\textit{Costsensitive learning by Cost-Proportionate instance},  		 			B Zadrozny 		,  		 			J Langford 		,  		 			Abe 		,  		 			N 		.  		 	 
\bibitem[Ajith et al. ()]{b1}\label{b1} 	 		‘Cyber Security and the Evolution of Intrusion Detection Systems’.  		 			G Ajith 		,  		 			C Crina 		,  		 			Yuehui 		.  	 	 		\textit{Information Management and Computer Security}  		2001. 9  (4)  p. .  	 
\bibitem[Abraham et al. ()]{b0}\label{b0} 	 		‘D-SCIDS: Distributed soft computing intrusion detection system’.  		 			R Abraham 		,  		 			J Jain 		,  		 			Thomas 		.  	 	 		\textit{Journal of Network and Computer Applications}  		2007. 30 p. .  	 
\bibitem[Bloedorn (2001)]{b7}\label{b7} 	 		\textit{Data Mining for Network Intrusion Detection: How to Get Started},  		 			E Bloedorn 		.  		August 2001.  	 	 (MITRE Technical Report) 
\bibitem[Sterrybrugger (2004)]{b26}\label{b26} 	 		\textit{Data Mining Methods for Network Intrusion Detection},  		 			Sterrybrugger 		.  		June 2004.  		 			University of California 		 	 
\bibitem[Elkan, C. The Foundations of Cost-Sensitive Learning Proceedings of the Seventeenth International Joint Conference of Artificial Intelligence ()]{b8}\label{b8} 	 		‘Elkan, C. The Foundations of Cost-Sensitive Learning’.  		 \url{<http://www-cse.ucsd.edu/users/elkan/clresults.html>10}  	 	 		\textit{Proceedings of the Seventeenth International Joint Conference of Artificial Intelligence},  				 (the Seventeenth International Joint Conference of Artificial IntelligenceSeattle, Washington)  		1999. 2001. p. .  	 	 (ElkanC Results of the KDD'99 Classifier Learning Contest) 
\bibitem[Drummond and Holte ()]{b6}\label{b6} 	 		‘Exploiting the cost (in) sensitivity of decision tree splitting the criteria’.  		 			C Drummond 		,  		 			R Holte 		.  	 	 		\textit{Proceedings of the 17 International Conference on Machine Learning},  				 (the 17 International Conference on Machine Learning)  		2000. p. .  	 
\bibitem[Selvakani and Rajesh (2007)]{b23}\label{b23} 	 		‘Genetic Algorithm for framing rules for intrusion Detection’.  		 			S Selvakani 		,  		 			R S Rajesh 		.  	 	 		\textit{IJCSNS International Journal of Computer Science and Network Security}  		November 2007. 7  (11) .  	 
\bibitem[Luo ()]{b9}\label{b9} 	 		\textit{Integrating Fuzzy Logic With Data Mining Methods for Intrusion Detection},  		 			J Luo 		.  		1999.  		 			Department of Computer Science, Mississippi State University 		 	 	 (Master's thesis) 
\bibitem[Alirezaosareh ()]{b2}\label{b2} 	 		‘Intrusion Detection in Computer Networks based on Machine Learning Algorithms’.  		 			Bitashadgar Alirezaosareh 		.  	 	 		\textit{IJCSNS International Journal of Computer Science and Network Security}  		2008. 8  (11) .  	 
\bibitem[Joseph and Rod ()]{b12}\label{b12} 	 		‘Intrusion detection: methods and systems’.  		 			Joseph 		,  		 			Rod 		.  	 	 		\textit{Information Management and Computer Security}  		2003. 11  (5)  p. .  	 
\bibitem[Jaideep Srivastava, Pang-Ning Tan, Data Mining for Network Intrusion Detection Nsl-kdd data set for network-based intrusion detection Systems. Available on ()]{b18}\label{b18} 	 		‘Jaideep Srivastava, Pang-Ning Tan, Data Mining for Network Intrusion Detection’.  		 \url{http://nsl.cs.unb.ca/NSL-KDD/}  	 	 		\textit{Nsl-kdd data set for network-based intrusion detection Systems. Available on},  				 (LeventErtoz, Vipin Kumar, AleksandarLazarevic)  		March, 2010. 22. 2001. Paul Dokas.  		 			University of Minnesota 		 	 
\bibitem[KDD CUP 1999 Data. The UCI KDD Archive Information and Computer Science]{b13}\label{b13} 	 		 \url{http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html}  		\textit{KDD CUP 1999 Data. The UCI KDD Archive Information and Computer Science},  				 (University of California,Irvine)  		 	 
\bibitem[Zadrozny and Elkan ()]{b29}\label{b29} 	 		‘Learning and Making Decisions When Costs and Probabilities are Both Unknown’.  		 			B Zadrozny 		,  		 			C Elkan 		.  	 	 		\textit{Proceedings of the Seventh International Conference on Knowledge Discovery and Data Mining},  				 (the Seventh International Conference on Knowledge Discovery and Data Mining)  		2001. p. .  	 
\bibitem[Provost ()]{b19}\label{b19} 	 		‘Machine learning from imbalanced data sets 101’.  		 			F Provost 		.  	 	 		\textit{Proceedings of the AAAI'2000 Workshop on Imbalanced Data},  				 (the AAAI'2000 Workshop on Imbalanced Data)  		2000.  	 
\bibitem[Simsongarfinkel and Spafford ()]{b25}\label{b25} 	 		\textit{Practical Security, O'Reilly and Associates},  		 			Gene Simsongarfinkel 		,  		 			Spafford 		.  		1991. Sebastopol, California.  	 
\bibitem[Tavallaee et al. ()]{b17}\label{b17} 	 		 			M Tavallaee 		,  		 			E Bagheri 		,  		 			W Lu 		,  		 			A Ghorbani 		.  		\textit{A Detailed Analysis of the KDD CUP 99 Data Set, IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA)},  				2009.  	 
\bibitem[Chai et al. ()]{b3}\label{b3} 	 		‘Test-Cost Sensitive Naïve Bayesian Classification’.  		 			X Chai 		,  		 			L Deng 		,  		 			Q Yang 		,  		 			C X Ling 		.  	 	 		\textit{Proceedings of the Fourth IEEE International Conference on Data Mining},  				 (the Fourth IEEE International Conference on Data MiningBrighton, UK)  		2004. IEEE Computer Society Press.  	 
\bibitem[Mchugh ()]{b10}\label{b10} 	 		‘Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory’.  		 			J Mchugh 		.  	 	 		\textit{ACM Transactions on Information and System Security}  		2000. 3  (4)  p. .  	 
\bibitem[Heady et al. (1990)]{b20}\label{b20} 	 		\textit{The Architecture of a Network Level Intrusion Detection System},  		 			R Heady 		,  		 			G Luger 		,  		 			A Maccabe 		,  		 			M Servilla 		.  		August 1990.  		 			Department of Computer Science, University of New Mexico 		 	 	 (Technical report) 
\bibitem[Heady et al. (1990)]{b21}\label{b21} 	 		\textit{The Architecture of a Network Level Intrusion Detection System},  		 			R Heady 		,  		 			G Luger 		,  		 			A Maccabe 		,  		 			M Servilla 		.  		August 1990.  		 			Department of Computer Science, University of New Mexico 		 	 	 (Technical report) 
\bibitem[Ertoz et al. ()]{b14}\label{b14} 	 		\textit{The MINDS -Minnesota intrusion detection system, next generation data mining},  		 			L Ertoz 		,  		 			E Eilerson 		,  		 			A Lazareviv 		.  		2004. MIT Press.  	 
\bibitem[Sheng and Ling ()]{b24}\label{b24} 	 		‘Thresholding for Making Classifiers Cost-sensitive’.  		 			V S Sheng 		,  		 			C X Ling 		.  	 	 		\textit{Proceedings of the 21National Conference on Artificial Intelligence},  				 (the 21National Conference on Artificial IntelligenceBoston, Massachusetts)  		2006. p. .  	 
\bibitem[Turney ()]{b27}\label{b27} 	 		‘Types of cost in inductive concept learning’.  		 			P D Turney 		.  	 	 		\textit{Proceedings of the Workshop on Cost-Sensitive Learning at the Seventeenth International Conference on Machine Learning},  				 (the Workshop on Cost-Sensitive Learning at the Seventeenth International Conference on Machine LearningCalifornia)  		2000.  		 			Stanford University 		 	 
\end{bibitemlist}
 			 		 	 
\end{document}
